June 1, 2016 - May 31, 2017

Concerns about the impact of disinformation and political bot operations heightened in the run-up to the 2017 French presidential election, as leaked communications related to candidate Emmanuel Macron were dumped online and amplified by automated accounts in attempts to destabilize the race right before campaigning closed (see Limits on Content).

The number of requests to take down or block pro-terrorism content increased significantly during the coverage period. While some of the decisions were disputed, no cases of “over-blocking” were reported (see Limits on Content).

In February 2017, France’s Constitutional Council struck down a new provision that criminalized the act of frequently visiting websites encouraging terrorism through the use of images of terrorist acts. Shortly after however, an amended version was reintroduced, imposing prison sentences on users who also “manifest adherence” to the ideology expressed on the site (see Violations of User Rights).

The Digital Republic Act adopted in October 2016 introduced new provisions to regulate the digital economy, including net neutrality and data protections. The law notably enables the French Data Protection Authority to impose heftier administrative fines for data protection violations (see Legal Environment).

Introduction:

France’s internet freedom environment declined slightly during a tense presidential election year, as the online sphere experienced a surge in disinformation and leaks aiming to destabilize the presidential race.

The past year was marked by a dramatic election campaign that resulted in the victory of centrist candidate Emmanuel Macron over far-right leader Marine Le Pen. The campaign was dominated by heightened concerns regarding the potential abuse of social media to deceive and manipulate public opinion. Although the surge in “fake news” and political bot operations did not ultimately manage to sway the result of the French election, the proliferation of disinformation and leaks seeking to disrupt the process raised alarm. Just hours before campaigning closed ahead of the runoff on May 7, 2017, thousands of leaked e-mails and documents from Emmanuel Macron's campaign team were dumped on the internet in a last minute effort to destabilize the race.

Measures to address terrorist threats have also continued to impact France’s internet freedom environment by expanding surveillance powers and limiting judicial oversight. Following a string of deadly terrorist attacks, a series of legislative changes to address threats to national security have sought to boost government surveillance powers and introduce stricter measures to tackle terrorist content online. Under the law prolonging the state of emergency following the deadly terrorist attack in Nice on July 14, 2016, an amendment authorized real-time collection of metadata of individuals not only “identified as a terrorist threat,” but also those “likely to be related” to a terrorist threat, or those who belong to the “entourage” of the person concerned. In October 2016, the Constitutional Council declared unconstitutional a section regarding surveillance of wireless communications in the Intelligence Law passed in July 2015, finding it disproportionate and in violation of the right to privacy and confidentiality of communications.

Since November 2015, France’s State of Emergency has been repeatedly extended for two years. These emergency measures significantly expanded authorities’ powers, such as allowing house arrests and searches without judicial oversight. In this context, United Nations human rights experts raised concerns about “excessive and disproportionate restrictions on fundamental freedoms” in France, including “the lack of clarity and precision of several provisions of the state of emergency and surveillance laws.”1 In June 2017, newly-elected President Macron announced plans for a new counter-terrorism law, which would seek to transfer some critical provisions of the state of emergency into permanent law.2

Obstacles to Access:

(Freedom on the Net Score: 0=Most Free, 100=Least Free)

France’s internet penetration continued to increase, although regional disparities persist. The current ICT market is open, highly competitive, and has benefited from the privatization of the state-owned company France Telecom.

Availability and Ease of Access

Committed to providing widespread access to high-speed broadband, the French government has been has been implementing an ambitious national plan to deploy high-speed broadband throughout France by 2022, mobilizing public and private investments totalling 20 billion euros (US$22 billion) over 10 years.3 As of December 2016, this plan benefited 50 percent of the population.4

Reforms approved in 2015, known as the “Loi Macron,” have sought to improve mobile broadband coverage in the country, requiring telecom operators to deploy 2G network in underserved municipalities by 2016, and ensure 3G/4G coverage by 2017.5 Despite some improvement however, high-speed LTE coverage in rural areas remained below the EU average.6

Demographic disparities in internet usage persist: for example, mobile penetration ranged from 67.7 percent in the Paris area to 47.5 percent in urban areas with less than 50,000 inhabitants.7 A map produced by regulator Arcep illustrates some of the regional disparities in mobile penetration, showing patchy coverage of 4G networks in rural areas.8 Most at-home users have access to broadband connections, while the remaining households are connected either through dial-up or satellite services, usually due to their rural location.9

Restrictions on Connectivity

There were no restrictions on connectivity reported during the coverage period. There is no central internet backbone, and ISPs are not required to lease bandwidth from a monopoly holder. Instead, the backbone consists of several interconnected networks run by ISPs and shared through peering or transit agreements. There are also a number of Internet Exchange Points (IXPs) in France,10 which contribute to improved access and lower consumer prices.11

ICT Market

There are no significant business hurdles to providing access to digital technologies in France. The main ISPs are Orange, Free, Bouygues Telecom, and Numericable-SFR (SFR was a division of Vivendi that was sold to Numericable).12 Others such as NRJ Mobile, Virgin Mobile, Cofidis Mobile, and Darty make use of the main ISPs’ networks, reselling the services.13

In July 2017,14 regulator ARCEP announced it would impose certain constraints on market leader Orange in an effort to open up competition for high-speed fiber services among small and medium-sized companies.15

Regulatory Bodies

The telecommunications industry in France is regulated by the Regulatory Authority for Electronic and Postal Communication (ARCEP),16 while competition is regulated by France’s Competition Authority and, more broadly, by the European Commission (EC).17 The commissioner of ARCEP is appointed by the government, but as an EU Member State, France must ensure the independence of its national telecommunications regulator. Given that the French state is the main shareholder in Orange, the country’s leading telecom company, the EC stated that it would closely monitor the situation in France to ensure that European regulations were being met.18 ARCEP remains an independent and impartial body and decisions made by the regulator are usually seen as fair.

The Digital Republic Act enacted in October 2016 broadened ARCEP's investigatory powers, notably granting ARCEP with investigatory and sanctioning powers to ensure compliance with the principle of net neutrality introduced by the law.19

Limits on Content:

(Freedom on the Net Score: 0=Most Free, 100=Least Free)

Following a string of deadly terrorist attacks in France, much attention has focused on mechanisms to counter pro-terrorist content online, resulting in an uptick of removal and blocking requests. Meanwhile, concerns surrounding disinformation and political bot operations heightened in the run-up to the 2017 French presidential election.

Blocking and Filtering

France does not generally engage in any politically-motivated blocking of websites. YouTube, Facebook, Twitter and international blog-hosting services as a whole are freely available. However, since the Charlie Hebdo and November 2015 attacks in Paris, the government has released statements suggesting that limiting fundamental rights of citizens would serve public safety,20 and terrorist-related content has been subject to censorship.

A decree issued in February 2015 outlined administrative measures to block websites containing materials that incite or condone terrorism, as well as sites that display child pornography.21 The decree implemented article 6-1 of the Law on Confidence in the Digital Economy (LCEN), passed in 2004, as well as article 12 of new antiterrorism law passed in November 2014.22 The administrative authority, in this case the Central Office for the Fight against Crime related to Information and Communication Technology (OCLCTIC), is in charge of creating a blacklist of sites containing infringing materials, and must review the list every four months to ensure that blacklisted sites continue to contravene French law. OCLCTIC can request editors or hosts to remove the content, and after a 24 hour period it can request ISPs to block the site.23 Users trying to access those pages are redirected to a website from the Ministry of Interior indicating why the site was blocked and avenues for appeal. Shortly after the decree was announced, five websites were blocked with no judicial or public oversight under suspicion of containing terrorism-related information.24

A chief concern related to blocking remains the lack of judicial oversight in the blocking of websites that incite or promote terrorist acts. The procedure is supervised by the National Commission on Informatics and Liberty (CNIL), the data protection agency. As an administrative authority, CNIL can also refer requests to the administrative court should they be unhappy with any action taken by the OCLCTIC. Some commentators have lamented that while CNIL was founded to protect internet freedoms, it is now overseeing the restriction of those same rights.25

The Paris attacks in November 2015 and the terrorist attack in Nice in July 2016 significantly impacted the number of overall requests to censor content linked to terrorism (see “Content Removal”). According to CNIL’s activity report covering the period between March 2016 and February 2017, French authorities made 874 requests to block sites, compared to 312 during the previous period (some of them were made available again after the removal of infringing content). Administrative blocking requests for terrorist content targeted 165 sites, compared to 709 sites displaying child abuse.26

This mechanism does not report the detailed content of websites blocked, but it does report censorship decisions disputed by CNIL. In one case in February 2017, the OCLCTIC requested the removal of a video related to the July 2016 Nice terrorist attack, accompanied by the text “Nice Attack July 14, 2016 live video of truck.” Following the removal request, access was blocked. CNIL considered that the text was neutral and judged the blocking order disproportionate.27

One isolated case of “over-blocking” was reported during this coverage period, but was mainly due to a technical incident: for 3 hours on October 17, 2016, Orange blocked the traffic to Google, Wikipedia and several websites for its 11 million landline customers, due to a wrong update to its DNS servers.28

Under the extended state of emergency legislation first adopted in November 2015, the interior minister was given the power to block websites and social media, taking “any measure to ensure the interruption of any public communication service online that glorifies or incites acts of terrorism.”29 Although the National Commission on Informatics and Liberty (CNIL) noted in its April 2016 report that the “implementation methods of this measure have not been specified, and to date, the Minister of Interior has not resorted to it.”30

Content Removal

French authorities are fairly transparent about what content is prohibited and the reasons behind specific content removal requests. Incitement of hatred, racism, Holocaust denial, child pornography, copyright infringement, and defamation are illegal. Article R645-1 of the French criminal code outlaws the display of the emblems, uniforms, or badges of criminal organizations, under penalty of a fine.31

As stipulated in the 2014 anti-terrorism law, the administrative authority (OCLCTIC) can request editors and hosts to remove content that incites or apologizes for terrorism, as well as sites that display child abuse; after a 24 hour period it can request ISPs to block the site (see Blocking and Filtering).32

A government decree issued on March 4, 2015 also allows for the delisting of online content from search results using a similar administrative procedure supervised by CNIL.33 Under this decree, OCLCTIC submits requests to search engines, which then have 48 hours to comply. The OCLCTIC is responsible for reevaluating de-indexed websites every four months, and requesting the relisting of websites where the incriminating content has been removed. According to CNIL’s report, between March 2016 and February 2017, French authorities submitted 2,077 de-indexing requests for content related to child abuse and terrorism (compared to 855 the previous year), as well as 2,561 removal requests (compared to 1,439 last year). Content was removed in 2,305 cases, 1,975 of which concerned pro-terrorist content. CNIL disputed a handful of these removal and de-indexing requests.34

The anti-piracy law HADOPI, originally passed in June 200935 and supplemented by a second law in October 200936 was once again in the news in 2016. In a surprise move, parliament adopted a proposal in April 2016 to suppress HADOPI by February 2022,37 but the Senate voted to reverse this move.38 HADOPI functions by responding to copyright infringers with a graduated response, starting with an email warning for the first offense, followed by a registered letter if a second offence occurs within six months. If a third offence occurs within a year of the registered letter, the case can be referred to the court, and the offender may receive a fine as a possible sanction.39 In June 2016, HADOPI published a report showcasing increased activity: it filed more than 688 referrals to court in the last year, more than twice than in the last five years (362 from 2010 to 2015). Most fines ranged from 50 to 1,000 euros.40

Legal debates over the right to be forgotten have also escalated in recent years. In June 2015, the French data protection agency CNIL ordered Google to extend the “right to be forgotten” ruling across all of its sites that can be accessed within the country, including Google.com and not just Google.fr.41 Google raised concerns that the move would set a dangerous precedent for authoritarian governments, who could also request that Google apply national laws extraterritorially.42 An informal appeal by Google was rejected in September 2015, and CNIL threatened to take action against Google with fines of approximately EUR 300,000 should they refuse to comply.43 In early February 2016, Google announced that it would comply by removing certain search results across all EU domains.44 In March 2016, Google was fined $112,000 by the CNIL for not complying with demands to remove results across its global domains.45 Google appealed to France’s Council of State, which in July 2017 decided to refer the matter to the Court of Justice of the European Union (ECJ).46

A ruling in early February 2016 by a Paris court established that Facebook could be sued in France for removing the account of a French user who posted an image of a 19th century painting of a naked woman by Gustave Courbet. A French court will now be entitled to hear the case, brought by the account’s Parisian user. Facebook had argued that cases concerning their terms and conditions could only be heard by a Santa Clara, CA court, where its headquarters are based. This was dismissed by a Paris appeals court, which ruled that should the case involve a French user, it can be heard in France. The decision can be appealed to France’s highest court.47

Media, Diversity and Content Manipulation

France is home to a highly diverse online media environment. Self-censorship online is minimal, and there were no reports of the French government proactively manipulating content online. However, concerns about disinformation and political bot operations heightened in the run-up to the 2017 French presidential election, and a trove of leaked documents sought to destabilize candidate Emmanuel Macron.

During the last months of the presidential election in April-May 2017, social media users were deluged with fake news stories.4849 In April, Facebook said that it had suspended 30,000 automated spam accounts in France, including many profiles that were distributing politically driven disinformation.50 While all presidential candidates were attacked, a large number of fake news reports were created and promoted by far-right online communities, promoting Marine Le Pen and attempting to undermine other candidates such as Emmanuel Macron.51 One study found that in April nearly one in five links shared on social media were from sources contesting the legitimacy of traditional media, and that some of these disruptive narratives emerged as “fake news.”52

On May 5, 2017, confidential documents from the campaign of Emmanuel Macron were leaked on the internet. The election commission warned media outlets to respect the campaign blackout period and not to comment on the leaks before election day, noting that some of the data appeared to be mixed with “false information.”53 Moreover, a study looking at tweets between the end of April and election day found that many automated accounts used in the context of #MacronLeaks had been created shortly prior to the 2016 U.S. presidential election, pointing to a “black market” of reusable political bots.54

In February 2017, the National Assembly definitely adopted a bill to criminalize websites spreading disinformation about abortion. For instance, some websites on the “voluntary interruption of pregnancy” and dedicated to “inform future mother on abortion and offer neutral and medical information” were in fact websites managed by anti-abortion activists.55

Digital Activism

French digital rights and advocacy groups, such as La Quadrature du Net (LQDN), are very active in the country, playing a significant role in protesting the government’s recent moves to expand surveillance and blocking measures without judicial oversight.56 In the past, LQDN successfully lobbied the European Parliament for an amendment to the European Union Telecoms Package to ensure that no restrictions on internet access could be imposed without prior judicial approval.57

In late 2015, users were able to share comments and interact via an online consultation platform designed to increase citizen engagement around the Digital Republic Bill that was finally adopted in October 2016, collecting 8,500 online contributions and almost 150,000 votes.58

Violations of User Rights:

(Freedom on the Net Score: 0=Most Free, 100=Least Free)

New laws to address threats to national security have bolstered the state’s surveillance powers and introduced stricter measures to tackle terrorist propaganda online. The prolonged state of emergency initiated after the Paris terrorist attacks in November 2015 has significantly expanded the powers of authorities to conduct house arrests, raids, and searches and seizures of devices, without judicial oversight.

Legal Environment

In accordance with the 1789 Declaration of the Rights of Man,59 France’s constitution guarantees freedom of speech.60 The European Convention on Human Rights, of which France is a signatory, provides for freedom of expression, subject to certain restrictions which are “necessary in a democratic society.”61

Since November 2015, broad new powers under the state of emergency have raised concerns among human rights and digital activists.62 While then Prime Minister Manuel Valls declared on November 19 that it was a “short term response,”63 the state of emergency was subsequently extended at least five times through July 2017.64 The state of emergency includes provisions on electronic searches (see Surveillance, Privacy, and Anonymity).65 The state of emergency also empowered the interior minister to take “any measure to ensure the interruption of any online public communication service that incites the commission of terrorist acts or glorifies them.”66

Meanwhile, measures to address terrorism were already in place prior to the November 2015 state of emergency. The antiterrorism law passed in November 2014 penalizes online speech deemed as “apology for terrorism” (apologie du terrorisme) with up to seven years in prison and a EUR 100,000 (US$100,000) fine. Online penalties are harsher than offline, which is subject to five years in prison and a EUR 75,000 fine.67 Another law adopted by parliament in May 2016 and enacted in June 2016 “on the fight against terrorism and organized crime” also provides sentences of up to two years in prison or a EUR 30,000 fine for frequently visiting sites that glorify or incite terrorist acts, unless these consultations are done in “good faith,” such as journalistic or research activities (see also Surveillance, Privacy, and Anonymity).68

France’s Constitutional Council finally rejected this last law in February 2017, arguing that the notion of “good faith” was unclear, and that the law was not “necessary, appropriate and proportionate.”69 Shortly after however, an amended version was reintroduced as part of a public security law, imposing prison sentences on users who also “manifest adherence” to the ideology expressed on the site.70

In a positive step, following a process of public consultation, the National Assembly adopted a “Digital Republic” bill in January 2016, covering a wide range of issues such as access to public data, safeguards for net neutrality, and the protection of personal data. The law was enacted in October 2017 with a final vote from the Senate.71

Prosecutions and Detentions for Online Activities

No citizens faced politically-motivated arrests or prosecutions, but multiple users have been sentenced for glorifying terrorism online.72 According to the figures from the Ministry of Justice, at least thirty-nine cases involved frequent visits to terrorist sites, after a new law passed in June 2016 criminalized the act of frequently consulting sites that glorify or incite terrorist acts (see Legal Environment). Twelve of these reported cases resulted in convictions.73

Surveillance, Privacy, and Anonymity

Surveillance has escalated in recent years, not least with the enactment of a new surveillance law in July 2015, which was passed in the wake of the attacks on Charlie Hebdo by armed extremists earlier that year.

The Loi Relatif au Renseignement, or Intelligence Law,74 allowed for intelligence agencies to conduct electronic surveillance without a court order and required ISPs to install so-called “black boxes,” algorithms that analyze users’ metadata for “suspicious” behavior in real time.75 In July 2016, an amendment authorized real-time collection of metadata of individuals not only “identified as a terrorist threat,” but also those “likely to be related” to a terrorist threat, or those who belong to the “entourage” of the person concerned.76

The French Constitutional Council had declared three of the law’s provisions unconstitutional in July 2015, including one that would have allowed the interception of all international electronic communications. However, an amendment enabling surveillance of electronic communications sent to or received from abroad was later adopted on November 30, 2015, shortly after the Paris attacks on November 13, for the purposes of “defending and promoting the fundamental interests of the country.”77 In October 21, 2016, the Constitutional Council censored part of the Intelligence Law related to the monitoring of Hertz wave communications after qualifying it as “disproportionate.”78

Under the state of emergency established in November 2015, the authorities were granted powers to access and copy user data, with little judicial oversight and without clarifying safeguards concerning the use of this data.79 The constitutional council struck down the provision allowing the authorities to copy user data in February 2016, citing the lack of judicial oversight.80 A new version of this provision was reintroduced in July 2016, adding certain judicial guarantees.81

A new law related to the fight against organized crime and terrorism, adopted by parliament in May 2016 and enacted in June 2016, has also elicited strong reactions from the public.82 The law notably expands special investigation methods to prosecutors and investigating judges, which were previously reserved for intelligence services. This includes bugging private locations, using phone eavesdropping devices such as IMSI catchers, and night-time searches.83 These “new techniques” were used as part of investigations during this period of coverage, in particular to prevent an attack targeting Disneyland Paris Park. Five Islamic State militants were arrested on November 20, 2016 in relation to this planned terrorist attack.84

Other recent regulations on electronic surveillance were passed in December 2013 and came into force in January 2015, as part of a routine military spending bill (the Military Programming Law, or LPM). Article 20 of the LPM significantly expanded electronic surveillance of French residents and businesses by requiring ISPs to hand over data such as phone conversations, emails, internet activity, personal location data, and other electronic communication data to public authorities. The powers relate to the General Directorate for Internal Security (DCRI), three intelligence agencies under the Ministry of Defense, as well as anti-money-laundering and customs agencies. Under the law, these agencies can conduct surveillance without prior court approval for purposes of “national security,” the protection of France’s “scientific and economical potential,” and the prevention of “terrorism” or “criminality.”85 The office of the prime minister authorizes surveillance and the National Commission for Security Interception (Commission nationale de contrôle des interceptions de sécurité, CNCIS) must be informed within 48 hours in order to ensure its approval.86 Critics have pointed out that the CNCIS lacks appropriate control mechanisms and independence from political interference, given that the CNCIS is composed of only three politicians.87 On the other hand, the government argued that the law provides an improved legal framework for practices that have already been in place for years.88

Article 23 of LOPPSI 2, adopted in 2011, grants the police with the authority to install malware—such as keystroke logging software and Trojan horses—on a suspect’s computer in the course of counterterrorism investigations, although authorization must come from a court order.89

The Digital Republic Act adopted in October 2016 seeks to enhance individuals’ rights to decide and control the use of their personal data. Companies will face hefty fines if they fail to comply: once the EU’s General Data Protection Regulation comes into force in 2018, CNIL will be able to fine up to 4 percent of total worldwide annual turnover for any data protection violations.90

A French order in February 2016 from the European Data Protection Authority ruled that Facebook was not allowed to track non-users in France or transfer personal data to U.S. servers. Facebook tracks the online movements of its users via its tracking cookies and plugins on third party websites, even if they are logged out. As part of a wider European investigation, CNIL fined Facebook 150,000 euros (approximately $170,000) in May 2017.91

Intimidation and Violence

While there were no reported physical attacks against bloggers or online journalists in France, outlets such as Canard Enchaîné and media site Mediapart reported receiving death threats in the lead-up to 2017 presidential elections.92

Under the state of emergency, human rights groups have documented abusive searches and house arrests based on suspected terrorist-related activity.93 Regional media have reported on a number of raids and seizures specifically targeting suspects of online activism and propaganda.94

Technical Attacks

Just hours before campaigning closed ahead of the presidential runoff on May 7, 2017, thousands of leaked e-mails and documents from Emmanuel Macron's campaign team were dumped on the internet in a last minute effort to destabilize the race (see Media, Diversity and Content Manipulation). According to a press release by Macron’s team on May 5, the campaign was the “victim of a massive and coordinated hacking attack” and that “those circulating these documents add many false documents to sow doubt and misinformation.”95 The Macron campaign team had previously confirmed being the target of phishing operations by a group of hackers and denounced “interference.”96

According to the Global State of Information Security Survey 2016, the number of recorded cyberattacks in France has grown by 51 percent in 2015 – which translates to approximately 21 attacks per day – compared to 38 percent globally.97 In response, French cybersecurity budgets have increased by an average of 29 percent, compared to 24 percent globally, commensurate with the financial loss caused by the incidents (EUR 3.7 million on average per company).98

2 On November 1, 2017, France officially lifted the state of emergency, and introduced a new anti-terror law. “Anti-terrorism: the Government wants the state of emergency to be the common law”, Le Monde, June 7, 2017, http://lemde.fr/2sSf31D

23 The blocking order can be issued immediately if the editor does not provide information stipulated under article 6-III of LCEN. See: Article 12, Law 2014-1353 of November 13, 2014, http://bit.ly/2eeaTwZ

59 “The free communication of ideas and opinions is one of the most precious of the rights of man. Every citizen may, accordingly, speak, write, and print with freedom, but shall be responsible for such abuses of this freedom as shall be defined by law.” See: Declaration of the Rights of Man 1789, September 1, 2016, http://bit.ly/1AgkDwp.

60 Guy Carcassonne, "The Principles of the French Constitution,” published on the website of the Embassy of France in Washington, DC, November 28, 2007, http://bit.ly/1X4r11P.

61 European Court of Human Rights, European Convention on Human Rights, accessed September 1, 2016, http://bit.ly/1foTq0D.

63 “Discours de Manuel VALLS, Premier ministre, Projet de loi sur la prorogation de l’état d’urgence, Assemblée nationale” [Speech by Manuel Valls, Prime Minister: bill on the extension of the state of emergency, National Assembly], gouvernement.fr, November 19, 2015, http://bit.ly/2duhrIJ.

64 See: Declaration of the State of Emergency, November 14, 2015; First extension of three months, Law 2016-162, February 19, 2016; Second extension of two months, Law 2016-629, May 20, 2016; Third extension of six months, Law 2016-987, July 21, 2016.

81 Alexandre Boudet, “La version 4 de l'état d'urgence est la plus musclée depuis novembre 2015” [Version 4 of the state of emergency : the most beefed up version since November 2015], Huffington Post, July 27, 2016, http://huff.to/2e1B8Uz